This advisory covers two main vulnerabilities in Red Hat OpenStack Platform 17.1: CVE-2025-21613, an argument injection vulnerability via the URL field, and CVE-2025-21614, a denial of service vulnerability in go-git clients triggered by malicious Git server responses. Both vulnerabilities are rated as important by Red Hat Product Security. The advisory also references a separate important security update for Grafana in Red Hat Enterprise Linux 9, addressing CVE-2025-30204, which involves excessive memory allocation during JWT header parsing. The vendor advisory provides update instructions and references for applying patches to affected products.

Successful exploitation of CVE-2025-21613 could allow an attacker to perform argument injection via the URL field, potentially leading to unintended command execution or manipulation. CVE-2025-21614 could allow denial of service attacks against go-git clients by sending maliciously crafted Git server replies. The Grafana vulnerability (CVE-2025-30204) could lead to excessive memory allocation, potentially causing service disruption. These vulnerabilities impact system stability and security, rated as important by Red Hat.

Red Hat has released security updates for Red Hat OpenStack Platform 17.1 (osp-director-operator) and Grafana in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the updates as detailed in the Red Hat advisory article https://access.redhat.com/articles/11258. No indication of 'no action required' or 'already mitigated' is present; therefore, applying the official patches is recommended to remediate these issues.